Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Toshi_Esumi
SuperUser
SuperUser

FMG: Use address objects in VIP object

We currently run v6.4.10 for our FMG-VM and manage bigger customer's FortiGates(FGTs) totalling about 600 (soon to be 800+).

And one of them needs one VIP group (two VIPs) at all 500+ locations. We use policy packages for this customer to standardize their policies, which is almost the same at all locations.

 

But when I looked at the VIP object config under Policy&Objects->Object Configurations->Firewall Objects->Virtual IPs then hit "Create New->Virtual IP", I don't see a way to select a dynamic address object for the External IP and Mapped IP.

This means we need to create 500+ x 2 VIPs manually putting each IP, then worse, we need to create 500+ different policies and use "Installation Target" to be for one specific FGT.

 

Is there a better way to have just one policy for one VIP group for 500+ FGTs?

 

Or, can I use meta fields+CLI template to define those on Device DB side and somehow let the policy to refer to the VIP group name? 

 

There should be a better way to do this, right?

 

Thanks,

 

 

Toshi

1 Solution
gfleming
Staff
Staff

I mean you can't use address objects in a VIP config on the FortiGate so why would you be able to on the FMG? 

 

Also you have to create unique entries already because each location likely requires a unique IP address for the VIP? So that's gonna be a lot of work anyway regardless of using objects or not.

 

There is a decent way of doing this though:

 

  1. Create the VIP to be shared in the policy package.
  2. Either use per-device mapping for each site to edit the appropriate IP addresses or,
  3. Use meta fields as you suggested and input the variable for the IP address in the VIP
Cheers,
Graham

View solution in original post

2 REPLIES 2
gfleming
Staff
Staff

I mean you can't use address objects in a VIP config on the FortiGate so why would you be able to on the FMG? 

 

Also you have to create unique entries already because each location likely requires a unique IP address for the VIP? So that's gonna be a lot of work anyway regardless of using objects or not.

 

There is a decent way of doing this though:

 

  1. Create the VIP to be shared in the policy package.
  2. Either use per-device mapping for each site to edit the appropriate IP addresses or,
  3. Use meta fields as you suggested and input the variable for the IP address in the VIP
Cheers,
Graham
Toshi_Esumi

Ok, my screen on the laptop was too small and I didn't scroll down all the way to the bottom to see "Per-device Mapping" ON/Off sliding switch. So VIPs can be actually dynamic objects I can configure different IP per-device. I'll use this feature.

 

I was thinking the meta fields method would probably work using a CLI template to define VIP config in Device DB instead of an object in the Policy&Object. But it might at least confuse our techs and might cause conflict when someone who doesn't know about the CLI template tries to create a VIP in the object DB temporarily to test something at one of locations.

 

In any case, I now see what you're explaining.

 

Thanks,

 

 

Toshi

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors